21 ms·

Illegal Life Pro Tip: Want to ruin your competitor's business?

470 points by redbell 3y ago

MicropenisMike 3y ago
This is a cool blog. Just super short ideas as a blog post that be read in under a minute. Thanks for sharing!
- dpcan 3y ago
  Like tweeting without Twitter.
  - patrickmay 3y ago
    Everything is better without Twitter! ;-)
- rationalist 3y ago
  After reading your comment, I went back to the website and checked out myself. You're right; thanks for pointing it out.
pitched 3y ago
I’ve heard that a lot of Shopify sites will have the auto credit card processing disabled for new orders. So that a real person can validate the order before hitting Stripe or whoever with it. Fraud orders are usually easy to spot by shipping addresses and you can get a good sense for it pretty quickly. It isn’t quite chicken sexing! Maybe the hot take here is that the best way to ruin your own business is to automate credit cards?
- tyingq 3y ago
  "Fraud orders are usually easy to spot by shipping addresses" You can find some of these by searching the shipping address and seeing if it's a freight forwarder or an obviously vacant home (listed on MLS with empty room pictures). Those kinds of shipping addresses have a pretty high fraud rates. But, if you mean seeing that the shipping address doesn't match the billing address on the card via AVS... That's trickier, especially for B2B spaces where a business owner buys with a credit card tied to their home address, but ships to their business.
  - yakireev 3y ago
    > You can find some of these by searching the shipping address and seeing if it's a freight forwarder Am a legitimate user of a freight forwarder, this attitude makes me sad.
    - tyingq 3y ago
      It's not really an attitude. I get that legitimate orders go that direction too. It's a flag to check into the order further. Same for vacant-looking addresses, mail-shop boxes, and so on...many are legit orders, many aren't. With credit card fraud, the merchant holds 100% of the liability. They lose the item they shipped, the shipping costs, the associated revenue, then some chargeback fees on top too. So, they check on things that could be fraud.
      - agos 3y ago
        doesn't 3DS or other types of SCA shift the liability off of the merchant?
        tyingq 3y ago
        I believe this is further along in other countries, but in the US, you lose a lot of sales as legit customers don't remember their 3DS passwords. I see stats quoting pretty high 3DS adoption in the US (30+%), which seems odd to me personally as I've never been prompted to use it.
        IIsi50MHz 3y ago
        3DS to me is still a Nintendo handheld game platform. I've never been asked to use anything other than 2FA — usually pretend 2FA in the form of a text to a mobile number. My hardware 2FA mostly sits unused, because almost nobody asks for it.
  - dacryn 3y ago
    I would assume the payment provider should handle those analytics, not the vendor
- ortusdux 3y ago
  Or maybe these processors should train an AI to find whatever pattern you are describing.
  - Arch485 3y ago
    That's sort of the problem - Payment processors know that fraud is occuring, and they punish the business owner.
    - anonzzzies 3y ago
      Yes, in an ideal world, they would find the fraudster and lock them up. But that’s not feasible and they need something to happen. Punishing the business owner makes no sense in many cases (like this one; you are not going to try to fraud your own system after 7 years of no issues), but that’s the only one they can get to.
jokethrowaway 3y ago
I wonder if something like Paddle, LemonSqueezy will protect you in this case. They are the merchant in that scenario and process refunds / chargebacks. Most likely they will punish you in some way though.
- neodypsis 3y ago
  Use a service like Sift, or better, ask your CC processor for 3D-Secure if possible.
xwdv 3y ago
Good tip, but it doesn’t even have to be a B2B attack. A sufficiently pissed off customer can order such an attack on a business that wronged them.
- DANmode 3y ago
  Or perhaps it is spammer who didn't like being played with theoretically by the author? https://oppositeinvictus.com/how-to-mess-with-spammers-for-seo-and-profit https://oppositeinvictus.com/how-to-mess-with-spammers-for-s...
PebblesHD 3y ago
No information given about the actual activities ongoing here so I’ll focus on the service providers behaviour directly. Given the meteoric rise of companies charging for services with no support of any type available for consumers other than hoping for traction on social media, how do we legislate to basically enforce some alternative to ‘computer says no, just make a new account and hope it doesnt happen again’. This seems like something consumer protections agencies should be all over. Australia’s consumer protection body is actually quite active in enforcing our rights when dealing with these sorts of things. Does America not have a similar agency or has it been captured by the companies it’s supposed to regulate? These companies are collecting sizeable profits and part of the way they’re achieving this is by simply disregarding all the support and engagement processes ‘normal’ businesses have to have claiming their scale makes them impossible. That should just not be an acceptable answer as far as consumer remedies are concerned.
- lmm 3y ago
  Payment processors are a natural monopoly and as such they should be regulated like utilities, i.e. not allowed to deny service without good reason. Unfortunately the government rather likes having a way to destroy the livelihoods of undesirables without any of that pesky due process.
  - wmf 3y ago
    The payment networks (Visa/MC/etc.) may be monopolies but there are ton of processors (Stripe/Paypal/etc.). Sure, all the smaller processors "suck" but somehow they worked before Stripe was founded.
    - somsak2 3y ago
      isn't the reason that stripe grew so quickly was because these smaller processors don't really work that well? i also keep hearing that there's a ton of choice but whenever it's brought up, true alternatives to PP/Stripe are rarely actually given
      - 3y ago
dijit 3y ago
If you are being unethical there are a bunch of things you can do. I would advise targeting people directly, anonymous letters directed to a spouse with accusations of cheating will help prevent executives from travelling and add a lot of personal stress on their lives, all it costs is a stamp. -- this is especially easy if you live in Sweden; since addresses and living arrangements are public info. Other things you can do is to fabricate something racist and pay for a few hundred bot accounts to follow any mention of the company or product. I have had both of these happen to me, and my industry is not very competitive nor am I a famous figure.
- zogrodea 3y ago
  I'm sorry to hear that happened to you. :( Sounds horrible.
quags 3y ago
I’m not a crypto evangelist by any means but one thing that I like about crypto is there are no charge backs. I added coinbase and it’s not a huge amount but about 5% of sales go over this. Apple/meta/amazon pay are also some what alternatives because the payment is going through a device that can be physically stolen but harder to do fraud than a virtual credit card.
- NotYourLawyer 3y ago
  DAO has entered the chat.
- lxgr 3y ago
  > one thing that I like about crypto is there are no charge backs. Most consumers probably don't like that at all, though.
  - quags 3y ago
    I view it as paying by cash, so the same type of pitfalls exist. I'm not really pushing crypto as the best payment method, just giving the OP possible alternative payment methods they could use. There is a learning curve to using crypto, which I believe reduces the potential of consumers not fully understating the risk of sending payments. Consumers who want the protections should use a credit card to get those.
- yieldcrv 3y ago
  Coinbase could freeze your ability to process or receive your payments for a dozen random reasons too. False sense of security there, you need self custody. Have open source self custody merchant tools improves? Brick and mortar gone online and Web 2.0 services seem pretty left behind for accepting crypto payment. And Web 3’s crypto natives don't care or need purchasing flows.
tough 3y ago
soon kyc in every ecommerce will be standard
- neodypsis 3y ago
  No need to. Just force card processor to implement 3D-Secure by default.
- anonzzzies 3y ago
  In many countries you have a cheap, easy to implement and fast bank to bank for online which is faster, cheaper and more secure. And as such, mostly impossible to chargeback because unless you had a gun to your head, it was you who did the transaction. In those regions, incentivise those means; give 5% discount for paying like that. We accept those in region where they are available, we also have our IBAN for you to pay directly. Some companies prefer that as they pay all their other invoices that way.
  - TRiG_Ireland 3y ago
    It would be relatively easy to implement in Ireland, but I've only used it once (buying from a shop in Germany). I placed the order on their website, and they gave me an IBAN and a reference number. I did a bank transfer to that account using the reference number they gave me, and they marked the invoice as paid and shipped the product. Simple system, though I'm not sure how they monitored their bank account: it may have been manual. It would work for any company which uses IBANs, which is all SEPA companies and many more besides. Australia has a system called POLi. This injects a popup into the checkout page of a website which allows you to log into your own bank and do a transfer from there. That works well, and seems quick and easy for the customer.
    - anonzzzies 3y ago
      If you have something like Revolut Business and a few other banks, you can just use the API to monitor.
esperent 3y ago
It's a constant fear, and there's no way to avoid using these companies. I'm currently dealing with a bakery business that was suddenly suspended from Google Maps. This is a big deal because it's the main way, by far, that people find us. 7 days ago, boom. Your account has been suspended for not following the business guidelines. The only thing I've updated recently was our hours. It's been listed without problems for about two years. Of course they don't tell you what the issue is. They just tell you to fix it and then beg them to reinstate you. It takes up to two weeks apparently (7 days so far). And if they decide not to, the only thing you can do is delete the listing, and two years worth of hard earned reviews go up in smoke. A few days ago one of our staff told me a Korean tourist came in the day before we were suspended and accused us of being fake. I don't know exactly what happened but due to the tourist's limited English nobody could persuade them we were the real location. Or maybe they were looking for somewhere else entirely? Who knows. Apparently they left a negative review, which I can't see while the account is suspended. Probably they reported the location as fake. So that's it. Two years, over 100 positive reviews sitting at 4.9 stars. Gone because of one confused tourist. Or maybe because I updated the hours. Or maybe an automatic spam check didn't like us. I sincerely hope that the next round of EU laws tackles this instead of privacy. It's just as big an issue, especially if you're running a small business.
- neodypsis 3y ago
  Also, how should a small business deal with fake negative reviews in, say, Play Store? Google does nothing to fix that. As the app developer you know a review from an account that didn't sign-up to your service is fake, especially when it appears at the same time other similar fake reviews do.
- kjkjadksj 3y ago
  Even if you dont want to be listed on google maps, they will sometimes generate a fake listing for you anyhow. I got burned by one of these as a customer, the link for takeout was not actually a site the restaurant was partnered with. I’ve also seen restaurants with similar names url squat these other places. It seems so bizzare google will publish such information without ever validating it with the business. It must cause a lot of damage and support quite the environment of scammers though.
eduction 3y ago
You can blame the evil competitor but the real problem is that credit cards are not the right tool for payments to strangers over the internet. Every time I do a CC transaction I’m giving a stranger exactly the information they need to do an entirely different, arbitrarily large CC transaction in my name with any merchant. That’s bonkers. I’ve recently seen more use of Apple Pay via websites. Assuming it works as Apple Pay usually does, this at least is technically more secure (though I don’t like giving Apple more power) since it’s basically an exchange of cryptographically secure/verifiable one time tokens. PayPal is no one’s favorite but at least if you use that you’re not handing over your CC number. (And yet they seem to lock out tons of merchants, hmm) Why are we still using credit cards? It’s not great as a consumer either - I have had my card locked for traveling within the same city and spending maybe $20 at a merchant I don’t usually visit. I had it locked because of a $5 web service monthly charge - and I had verified the same charge the two prior months.
- tough 3y ago
  CC in europe require a 2fa confirmation where you recieve usually a notice of the amount you're approving
  - reaperducer 3y ago
    CC in europe require a 2fa confirmation where you recieve usually a notice of the amount you're approving How does that work when you buy things in places where you don't have cell service? Yes, they exist. Even in Europe.
    - bonestamp2 3y ago
      I guess in those cases, something offline like google authenticator (or similar) would be better.
    - SXX 3y ago
      > Yes, they exist. Even in Europe. You mean you have wi-fi, but don't have cell service? That is like... super rare.
Waterluvian 3y ago
> 10 year relationship with Paypal and 7 year relationship with stripe Not that the author is implying this, but don’t ever make the mistake of thinking that these numbers ever matter. It’s not 1973 and you don’t shake hands with your banker. The only number that matters is the number of dollars going through Stripe or PayPal because of your business.
- SkyPuncher 3y ago
  Further, the $500k number is absolutely nothing that stripe cares about. They only take a fraction of
111111IIIIIII 3y ago
> as a solo SaaS builder it seems harder and harder these days to have any sort of job security This overlooks the hard work and risk undertook by the virtuous founders of Paypal and Stripe. *SBOs love to advocate the virtues of "risk-taking" to defend exploiting others, and the opposite when they find themselves at the other end of the exploitation.
tehwebguy 3y ago
Here’s a question, if Stripe or PayPal for example are processing so many transactions why can’t they see this stuff coming a mile away? Shouldn’t it be trivial to “triangulate” the origin of a card hack / leak after like, I don’t know, three or four transactions? This whole thing seems rigged to put make small businesses liable for covering the cost of the PII failure of probably a banking institution, or a minimum a completely different small business!
deleted 3y ago
[deleted]
musicale 3y ago
> Big corporations with billions in profits without any real support staff…. No support staff is probably how they scaled up to billions in profits in the first place.
Zuiii 3y ago
I hope this attack becomes more popular. I truly do. Maybe these attacks will finally force regulators to do something about the financial parasites we call "payment processors". Any payment processing system that doesn't act like a public utility is broken and needs fixing. I think the only digital payment system that comes close to acting like a utility right now is cryptocurrecny which is a sad, sad state of affairs. OP: While not a complete solution, you might be able to partially mitigate this by allowing customers to pay you in other forms (e.g aforementioned cryptocurrency, bank transfers). That's what the porn industry and other legal businesses end up doing when they inevitably find themselves in your position. If your customers want your product badly enough, a small fraction of them will learn how to use these payment methods. You'll have to learn to survive on those alone.
- nwienert 3y ago
  Why is it sad? I truly don’t get it, people on HN will say they are somewhat libertarian, pro decentralization, anti corporate oligopolies, but then use their dying breath to say “crypto has no use case”. Yet while AI took nearly 70 years to find its footing, in just 10 years crypto (currencies) has already found inroads into many areas as a nascent technology that has massive potential to solve some of our biggest problems. I truly think it’s one of those cases where the “wrong/dumb” people jumped onto it (alongside scammers) and so it became poisoned to the right/smart ones. But we should be way better than that! Is it really so hard for people to separate good from bad? It absolutely bowls me over to see this lack of ability to discuss it carefully around here so consistently. So many potential amazing conversations totally shunted by the absolute need to turn it tribal.
  - haruka_ff 3y ago
    > Is it really so hard for people to separate good from bad? If you mean "HN people", then probably no; but if you mean more generalized "people", then definitely yes. Unfortunately, your customers are much more likely from the latter group. Also, being in a sad state doesn't really mean it "has no use case", right?
    - 3y ago
anonzzzies 3y ago
Try talking to a local (office close-ish to you) processor or acquirer. You usually need a good amount of transactions to get them interested, but they will have support, they will discuss before taking any measures etc.
bryan_w 3y ago
Let me guess, you think cloudflare is the devil, right? This is happening because you are basically leaving your PoS system open and unattended while a scammer walks by with a wheelbarrow full of freshly stolen credit cards. Throw a captcha on that checkout page at least for goodness sakes
easyThrowaway 3y ago
As someone who worked in France for a medium-ish size media agency, we had something similar happening to our google adwords account... and it took ~2 weeks for our legal studio to get it back with direct support from google. Afaik it mostly took them to basically write a few legal letters and telling them "our legal representatives would be glad to meet you at your offices at Google France and discuss such unfortunate issue and so and so" - they basically went "how about no" and restored the account. Laywer fees weren't particularly cheap (in the range of 2500-5000€) but still well below the money we were losing. Is this not an option for US-based businesses? I have heard similar horror stories like the one on the OP a few times already but I've rarely seen them pursue a similar path.
- MrFoof 3y ago
  >Is this not an option for US-based businesses? It is absolutely an option. Some people simply choose not to pursue it for many reasons ranging from financial, to a matter of principal, effort required, or any other number of reasons.
- paulddraper 3y ago
  It is an option. You'll notice those stories rarely include "and I talked to my lawyer"
jesterson 3y ago
I know it's probably downvoted as society has sweet spot for pity, but to certain extend it's OP's fault. As a merchant, you need to do proper anti-fraud system. Especially considering influx of orders with stolen CC. It's just necessary to avoid huge financial and reputational losses. Don't rely on Shopify/Stripe "anti-fraud" - it's absolute garbage selling feeling of security. Proper analysis of order flow with spotting irregularities across many datapoints are needed. Some may whine things are not fair - yes they are not, and never will be. You just need to adapt.
lee101 3y ago
[dead]
shreyshnaccount 3y ago
Reading so many of the comments in this thread just strengthens my belief that we need large platforms to be governed like utilities, or even better, open source alternative based utilities
Aachen 3y ago
I wonder what it is that we do differently such that I never hear of these problems from natively European payment methods. E.g. the payment platform iDeal draws directly from your bank account but there is apparently no significant trade in stolen logins. What makes that not as lucrative?
- carstenhag 3y ago
  Related, but not strictly the same: a week ago my IBAN (eu-wide bank account number) was used via a Paypal guest account to make payments of 580€, paying through direct debit (Lastschrift). There is no inherent security at all. Merchants usually send you 1 cent with a 2fa code, in order to verify that you have access to the account. In my case this was not done apparently, and the scammers got their items. I was able to do something similar to a charge back, but I wonder whether the online store or PayPal will have to eat the loss.
sersi 3y ago
Sidenote, I remember some people here wondering why websites don't explain why a transaction failed (wrong CVV, wrong AVS or Do not honor, etc...). This is what happens if you do give this kind of error through, don't put some form of rate limiting, etc.. It becomes a convenient site for scammers to test stolen credit cards and you end up being flagged by your payment provider. Also, it's worth having a relationship with a smaller payment gateway, merchant account provider. It insulates you somewhat.
Euphorbium 3y ago
I unable to log in to my paypal account, because the confirmation sms never arrives, and the only contact given is to call them. Guess I’ll never use paypal again.
- tacocataco 3y ago
  I just wish there was adversarial integration on these payment apps. I'm tired of setting up new ones. Imagine if our phones still worked liked they originally did, where you could only call other people using the carrier you are. Oh you have T-mobile? Sorry. I have AT&T, i will write you a letter. We didn't put up with it back then, and we shouldn't put up with it now.
gregw2 3y ago
Been there. It might be competitors. It might just be fraudsters looking to see what they can get for free from that otherwise useless stash of credit card numbers they stole or got on some forum from someone who did. Once your marketing hits the radar of one of these crews they will pass your service on to each other. As a merchant you need to develop your own fraud screening techniques or pay someone to do it. (Pardon me if I am projecting from my past startup experience to yours in all my comments.) I am not blaming the victim. But the industry is setup so the merchant is most responsible for detecting and dealing with fraud. And that is probably objectively not a bad call. You have all kinds of ways to detect who is doing this and ways to stop this. I hate this crime with a passion and cut it down from 5000/mo to 50/month at my first startup when it blew up on us. But it is true the credit card middlemen, having externalities the risk to you, don’t then innovate incremental tools for merchants that well. I was frustrated when I received fraudulent requests there was no third party I could report my suspicions of fraud to with a confidence rating (or check against other merchants suspicions). I did many years later see a service like that but now can’t find it. I did just now find a pretty good list of merchant anti fraud tactics which had tricks nobody told me at the time but I had to figure out myself and were pretty successful: https://support.authorize.net/knowledgebase/Knowledgearticle/?code=000002330 https://support.authorize.net/knowledgebase/Knowledgearticle... Good luck. These guys are persistent. In my case most of them were coming from poor countries where a dollar of fraud is worth a lot more of their time than yours. Until you stop them cold, they will keep coming.
- moneywoes 3y ago
  What was your most successful defence to these attacks?
  - speleding 3y ago
    No OP, but I had it happen to me and adding a "3DS" card verification to the checkout flow made the problem go away. The 3DS step is where they text the customer a number they have to type in to proceed. It's a pain for the customer so I only do it on newish accounts, repeat customers don't get bothered.
  - 3y ago
Gijs4g 3y ago
Use Mollie, they have great customer support.
asow92 3y ago
This is something I could see CA, NY, or the EU taking on someday with some sort of "right to digital recourse" law.
T3RMINATED 3y ago
[dead]
moneywoes 3y ago
Are there no alternative payment gateways?
norswap 3y ago
I read about stuff like this every month, but then people (on the internet) tell me there are no uses for blockchains and they're exlusively for scams (yes, scams exists, a lot of them).

470 points by redbell 3y ago

MicropenisMike 3y ago

This is a cool blog. Just super short ideas as a blog post that be read in under a minute. Thanks for sharing!

dpcan 3y ago
Like tweeting without Twitter.
- patrickmay 3y ago
  Everything is better without Twitter! ;-)
rationalist 3y ago
After reading your comment, I went back to the website and checked out myself. You're right; thanks for pointing it out.

pitched 3y ago

I’ve heard that a lot of Shopify sites will have the auto credit card processing disabled for new orders. So that a real person can validate the order before hitting Stripe or whoever with it. Fraud orders are usually easy to spot by shipping addresses and you can get a good sense for it pretty quickly. It isn’t quite chicken sexing! Maybe the hot take here is that the best way to ruin your own business is to automate credit cards?

tyingq 3y ago
"Fraud orders are usually easy to spot by shipping addresses" You can find some of these by searching the shipping address and seeing if it's a freight forwarder or an obviously vacant home (listed on MLS with empty room pictures). Those kinds of shipping addresses have a pretty high fraud rates. But, if you mean seeing that the shipping address doesn't match the billing address on the card via AVS... That's trickier, especially for B2B spaces where a business owner buys with a credit card tied to their home address, but ships to their business.
- yakireev 3y ago
  > You can find some of these by searching the shipping address and seeing if it's a freight forwarder Am a legitimate user of a freight forwarder, this attitude makes me sad.
  - tyingq 3y ago
    It's not really an attitude. I get that legitimate orders go that direction too. It's a flag to check into the order further. Same for vacant-looking addresses, mail-shop boxes, and so on...many are legit orders, many aren't. With credit card fraud, the merchant holds 100% of the liability. They lose the item they shipped, the shipping costs, the associated revenue, then some chargeback fees on top too. So, they check on things that could be fraud.
    - agos 3y ago
      doesn't 3DS or other types of SCA shift the liability off of the merchant?
      - tyingq 3y ago
        I believe this is further along in other countries, but in the US, you lose a lot of sales as legit customers don't remember their 3DS passwords. I see stats quoting pretty high 3DS adoption in the US (30+%), which seems odd to me personally as I've never been prompted to use it.
        IIsi50MHz 3y ago
        3DS to me is still a Nintendo handheld game platform. I've never been asked to use anything other than 2FA — usually pretend 2FA in the form of a text to a mobile number. My hardware 2FA mostly sits unused, because almost nobody asks for it.
- dacryn 3y ago
  I would assume the payment provider should handle those analytics, not the vendor
ortusdux 3y ago
Or maybe these processors should train an AI to find whatever pattern you are describing.
- Arch485 3y ago
  That's sort of the problem - Payment processors know that fraud is occuring, and they punish the business owner.
  - anonzzzies 3y ago
    Yes, in an ideal world, they would find the fraudster and lock them up. But that’s not feasible and they need something to happen. Punishing the business owner makes no sense in many cases (like this one; you are not going to try to fraud your own system after 7 years of no issues), but that’s the only one they can get to.

jokethrowaway 3y ago

I wonder if something like Paddle, LemonSqueezy will protect you in this case. They are the merchant in that scenario and process refunds / chargebacks. Most likely they will punish you in some way though.

neodypsis 3y ago
Use a service like Sift, or better, ask your CC processor for 3D-Secure if possible.

xwdv 3y ago

Good tip, but it doesn’t even have to be a B2B attack. A sufficiently pissed off customer can order such an attack on a business that wronged them.

DANmode 3y ago
Or perhaps it is spammer who didn't like being played with theoretically by the author? https://oppositeinvictus.com/how-to-mess-with-spammers-for-seo-and-profit https://oppositeinvictus.com/how-to-mess-with-spammers-for-s...

PebblesHD 3y ago

No information given about the actual activities ongoing here so I’ll focus on the service providers behaviour directly. Given the meteoric rise of companies charging for services with no support of any type available for consumers other than hoping for traction on social media, how do we legislate to basically enforce some alternative to ‘computer says no, just make a new account and hope it doesnt happen again’. This seems like something consumer protections agencies should be all over. Australia’s consumer protection body is actually quite active in enforcing our rights when dealing with these sorts of things. Does America not have a similar agency or has it been captured by the companies it’s supposed to regulate? These companies are collecting sizeable profits and part of the way they’re achieving this is by simply disregarding all the support and engagement processes ‘normal’ businesses have to have claiming their scale makes them impossible. That should just not be an acceptable answer as far as consumer remedies are concerned.

lmm 3y ago
Payment processors are a natural monopoly and as such they should be regulated like utilities, i.e. not allowed to deny service without good reason. Unfortunately the government rather likes having a way to destroy the livelihoods of undesirables without any of that pesky due process.
- wmf 3y ago
  The payment networks (Visa/MC/etc.) may be monopolies but there are ton of processors (Stripe/Paypal/etc.). Sure, all the smaller processors "suck" but somehow they worked before Stripe was founded.
  - somsak2 3y ago
    isn't the reason that stripe grew so quickly was because these smaller processors don't really work that well? i also keep hearing that there's a ton of choice but whenever it's brought up, true alternatives to PP/Stripe are rarely actually given
    - 3y ago

dijit 3y ago

If you are being unethical there are a bunch of things you can do. I would advise targeting people directly, anonymous letters directed to a spouse with accusations of cheating will help prevent executives from travelling and add a lot of personal stress on their lives, all it costs is a stamp. -- this is especially easy if you live in Sweden; since addresses and living arrangements are public info. Other things you can do is to fabricate something racist and pay for a few hundred bot accounts to follow any mention of the company or product. I have had both of these happen to me, and my industry is not very competitive nor am I a famous figure.

zogrodea 3y ago
I'm sorry to hear that happened to you. :( Sounds horrible.

quags 3y ago

I’m not a crypto evangelist by any means but one thing that I like about crypto is there are no charge backs. I added coinbase and it’s not a huge amount but about 5% of sales go over this. Apple/meta/amazon pay are also some what alternatives because the payment is going through a device that can be physically stolen but harder to do fraud than a virtual credit card.

NotYourLawyer 3y ago
DAO has entered the chat.
lxgr 3y ago
> one thing that I like about crypto is there are no charge backs. Most consumers probably don't like that at all, though.
- quags 3y ago
  I view it as paying by cash, so the same type of pitfalls exist. I'm not really pushing crypto as the best payment method, just giving the OP possible alternative payment methods they could use. There is a learning curve to using crypto, which I believe reduces the potential of consumers not fully understating the risk of sending payments. Consumers who want the protections should use a credit card to get those.
yieldcrv 3y ago
Coinbase could freeze your ability to process or receive your payments for a dozen random reasons too. False sense of security there, you need self custody. Have open source self custody merchant tools improves? Brick and mortar gone online and Web 2.0 services seem pretty left behind for accepting crypto payment. And Web 3’s crypto natives don't care or need purchasing flows.

tough 3y ago

soon kyc in every ecommerce will be standard

neodypsis 3y ago
No need to. Just force card processor to implement 3D-Secure by default.
anonzzzies 3y ago
In many countries you have a cheap, easy to implement and fast bank to bank for online which is faster, cheaper and more secure. And as such, mostly impossible to chargeback because unless you had a gun to your head, it was you who did the transaction. In those regions, incentivise those means; give 5% discount for paying like that. We accept those in region where they are available, we also have our IBAN for you to pay directly. Some companies prefer that as they pay all their other invoices that way.
- TRiG_Ireland 3y ago
  It would be relatively easy to implement in Ireland, but I've only used it once (buying from a shop in Germany). I placed the order on their website, and they gave me an IBAN and a reference number. I did a bank transfer to that account using the reference number they gave me, and they marked the invoice as paid and shipped the product. Simple system, though I'm not sure how they monitored their bank account: it may have been manual. It would work for any company which uses IBANs, which is all SEPA companies and many more besides. Australia has a system called POLi. This injects a popup into the checkout page of a website which allows you to log into your own bank and do a transfer from there. That works well, and seems quick and easy for the customer.
  - anonzzzies 3y ago
    If you have something like Revolut Business and a few other banks, you can just use the API to monitor.

esperent 3y ago

It's a constant fear, and there's no way to avoid using these companies. I'm currently dealing with a bakery business that was suddenly suspended from Google Maps. This is a big deal because it's the main way, by far, that people find us. 7 days ago, boom. Your account has been suspended for not following the business guidelines. The only thing I've updated recently was our hours. It's been listed without problems for about two years. Of course they don't tell you what the issue is. They just tell you to fix it and then beg them to reinstate you. It takes up to two weeks apparently (7 days so far). And if they decide not to, the only thing you can do is delete the listing, and two years worth of hard earned reviews go up in smoke. A few days ago one of our staff told me a Korean tourist came in the day before we were suspended and accused us of being fake. I don't know exactly what happened but due to the tourist's limited English nobody could persuade them we were the real location. Or maybe they were looking for somewhere else entirely? Who knows. Apparently they left a negative review, which I can't see while the account is suspended. Probably they reported the location as fake. So that's it. Two years, over 100 positive reviews sitting at 4.9 stars. Gone because of one confused tourist. Or maybe because I updated the hours. Or maybe an automatic spam check didn't like us. I sincerely hope that the next round of EU laws tackles this instead of privacy. It's just as big an issue, especially if you're running a small business.

neodypsis 3y ago
Also, how should a small business deal with fake negative reviews in, say, Play Store? Google does nothing to fix that. As the app developer you know a review from an account that didn't sign-up to your service is fake, especially when it appears at the same time other similar fake reviews do.
kjkjadksj 3y ago
Even if you dont want to be listed on google maps, they will sometimes generate a fake listing for you anyhow. I got burned by one of these as a customer, the link for takeout was not actually a site the restaurant was partnered with. I’ve also seen restaurants with similar names url squat these other places. It seems so bizzare google will publish such information without ever validating it with the business. It must cause a lot of damage and support quite the environment of scammers though.

eduction 3y ago

You can blame the evil competitor but the real problem is that credit cards are not the right tool for payments to strangers over the internet. Every time I do a CC transaction I’m giving a stranger exactly the information they need to do an entirely different, arbitrarily large CC transaction in my name with any merchant. That’s bonkers. I’ve recently seen more use of Apple Pay via websites. Assuming it works as Apple Pay usually does, this at least is technically more secure (though I don’t like giving Apple more power) since it’s basically an exchange of cryptographically secure/verifiable one time tokens. PayPal is no one’s favorite but at least if you use that you’re not handing over your CC number. (And yet they seem to lock out tons of merchants, hmm) Why are we still using credit cards? It’s not great as a consumer either - I have had my card locked for traveling within the same city and spending maybe $20 at a merchant I don’t usually visit. I had it locked because of a $5 web service monthly charge - and I had verified the same charge the two prior months.

tough 3y ago
CC in europe require a 2fa confirmation where you recieve usually a notice of the amount you're approving
- reaperducer 3y ago
  CC in europe require a 2fa confirmation where you recieve usually a notice of the amount you're approving How does that work when you buy things in places where you don't have cell service? Yes, they exist. Even in Europe.
  - bonestamp2 3y ago
    I guess in those cases, something offline like google authenticator (or similar) would be better.
  - SXX 3y ago
    > Yes, they exist. Even in Europe. You mean you have wi-fi, but don't have cell service? That is like... super rare.

Waterluvian 3y ago

> 10 year relationship with Paypal and 7 year relationship with stripe Not that the author is implying this, but don’t ever make the mistake of thinking that these numbers ever matter. It’s not 1973 and you don’t shake hands with your banker. The only number that matters is the number of dollars going through Stripe or PayPal because of your business.

SkyPuncher 3y ago
Further, the $500k number is absolutely nothing that stripe cares about. They only take a fraction of

111111IIIIIII 3y ago

> as a solo SaaS builder it seems harder and harder these days to have any sort of job security This overlooks the hard work and risk undertook by the virtuous founders of Paypal and Stripe. *SBOs love to advocate the virtues of "risk-taking" to defend exploiting others, and the opposite when they find themselves at the other end of the exploitation.

tehwebguy 3y ago

Here’s a question, if Stripe or PayPal for example are processing so many transactions why can’t they see this stuff coming a mile away? Shouldn’t it be trivial to “triangulate” the origin of a card hack / leak after like, I don’t know, three or four transactions? This whole thing seems rigged to put make small businesses liable for covering the cost of the PII failure of probably a banking institution, or a minimum a completely different small business!

deleted 3y ago

[deleted]

musicale 3y ago

> Big corporations with billions in profits without any real support staff…. No support staff is probably how they scaled up to billions in profits in the first place.

Zuiii 3y ago

I hope this attack becomes more popular. I truly do. Maybe these attacks will finally force regulators to do something about the financial parasites we call "payment processors". Any payment processing system that doesn't act like a public utility is broken and needs fixing. I think the only digital payment system that comes close to acting like a utility right now is cryptocurrecny which is a sad, sad state of affairs. OP: While not a complete solution, you might be able to partially mitigate this by allowing customers to pay you in other forms (e.g aforementioned cryptocurrency, bank transfers). That's what the porn industry and other legal businesses end up doing when they inevitably find themselves in your position. If your customers want your product badly enough, a small fraction of them will learn how to use these payment methods. You'll have to learn to survive on those alone.

nwienert 3y ago
Why is it sad? I truly don’t get it, people on HN will say they are somewhat libertarian, pro decentralization, anti corporate oligopolies, but then use their dying breath to say “crypto has no use case”. Yet while AI took nearly 70 years to find its footing, in just 10 years crypto (currencies) has already found inroads into many areas as a nascent technology that has massive potential to solve some of our biggest problems. I truly think it’s one of those cases where the “wrong/dumb” people jumped onto it (alongside scammers) and so it became poisoned to the right/smart ones. But we should be way better than that! Is it really so hard for people to separate good from bad? It absolutely bowls me over to see this lack of ability to discuss it carefully around here so consistently. So many potential amazing conversations totally shunted by the absolute need to turn it tribal.
- haruka_ff 3y ago
  > Is it really so hard for people to separate good from bad? If you mean "HN people", then probably no; but if you mean more generalized "people", then definitely yes. Unfortunately, your customers are much more likely from the latter group. Also, being in a sad state doesn't really mean it "has no use case", right?
  - 3y ago

anonzzzies 3y ago

Try talking to a local (office close-ish to you) processor or acquirer. You usually need a good amount of transactions to get them interested, but they will have support, they will discuss before taking any measures etc.

bryan_w 3y ago

Let me guess, you think cloudflare is the devil, right? This is happening because you are basically leaving your PoS system open and unattended while a scammer walks by with a wheelbarrow full of freshly stolen credit cards. Throw a captcha on that checkout page at least for goodness sakes

easyThrowaway 3y ago

As someone who worked in France for a medium-ish size media agency, we had something similar happening to our google adwords account... and it took ~2 weeks for our legal studio to get it back with direct support from google. Afaik it mostly took them to basically write a few legal letters and telling them "our legal representatives would be glad to meet you at your offices at Google France and discuss such unfortunate issue and so and so" - they basically went "how about no" and restored the account. Laywer fees weren't particularly cheap (in the range of 2500-5000€) but still well below the money we were losing. Is this not an option for US-based businesses? I have heard similar horror stories like the one on the OP a few times already but I've rarely seen them pursue a similar path.

MrFoof 3y ago
>Is this not an option for US-based businesses? It is absolutely an option. Some people simply choose not to pursue it for many reasons ranging from financial, to a matter of principal, effort required, or any other number of reasons.
paulddraper 3y ago
It is an option. You'll notice those stories rarely include "and I talked to my lawyer"

jesterson 3y ago

I know it's probably downvoted as society has sweet spot for pity, but to certain extend it's OP's fault. As a merchant, you need to do proper anti-fraud system. Especially considering influx of orders with stolen CC. It's just necessary to avoid huge financial and reputational losses. Don't rely on Shopify/Stripe "anti-fraud" - it's absolute garbage selling feeling of security. Proper analysis of order flow with spotting irregularities across many datapoints are needed. Some may whine things are not fair - yes they are not, and never will be. You just need to adapt.

lee101 3y ago

[dead]

shreyshnaccount 3y ago

Reading so many of the comments in this thread just strengthens my belief that we need large platforms to be governed like utilities, or even better, open source alternative based utilities

Aachen 3y ago

I wonder what it is that we do differently such that I never hear of these problems from natively European payment methods. E.g. the payment platform iDeal draws directly from your bank account but there is apparently no significant trade in stolen logins. What makes that not as lucrative?

carstenhag 3y ago
Related, but not strictly the same: a week ago my IBAN (eu-wide bank account number) was used via a Paypal guest account to make payments of 580€, paying through direct debit (Lastschrift). There is no inherent security at all. Merchants usually send you 1 cent with a 2fa code, in order to verify that you have access to the account. In my case this was not done apparently, and the scammers got their items. I was able to do something similar to a charge back, but I wonder whether the online store or PayPal will have to eat the loss.

sersi 3y ago

Sidenote, I remember some people here wondering why websites don't explain why a transaction failed (wrong CVV, wrong AVS or Do not honor, etc...). This is what happens if you do give this kind of error through, don't put some form of rate limiting, etc.. It becomes a convenient site for scammers to test stolen credit cards and you end up being flagged by your payment provider. Also, it's worth having a relationship with a smaller payment gateway, merchant account provider. It insulates you somewhat.

Euphorbium 3y ago

I unable to log in to my paypal account, because the confirmation sms never arrives, and the only contact given is to call them. Guess I’ll never use paypal again.

tacocataco 3y ago
I just wish there was adversarial integration on these payment apps. I'm tired of setting up new ones. Imagine if our phones still worked liked they originally did, where you could only call other people using the carrier you are. Oh you have T-mobile? Sorry. I have AT&T, i will write you a letter. We didn't put up with it back then, and we shouldn't put up with it now.

gregw2 3y ago

Been there. It might be competitors. It might just be fraudsters looking to see what they can get for free from that otherwise useless stash of credit card numbers they stole or got on some forum from someone who did. Once your marketing hits the radar of one of these crews they will pass your service on to each other. As a merchant you need to develop your own fraud screening techniques or pay someone to do it. (Pardon me if I am projecting from my past startup experience to yours in all my comments.) I am not blaming the victim. But the industry is setup so the merchant is most responsible for detecting and dealing with fraud. And that is probably objectively not a bad call. You have all kinds of ways to detect who is doing this and ways to stop this. I hate this crime with a passion and cut it down from 5000/mo to 50/month at my first startup when it blew up on us. But it is true the credit card middlemen, having externalities the risk to you, don’t then innovate incremental tools for merchants that well. I was frustrated when I received fraudulent requests there was no third party I could report my suspicions of fraud to with a confidence rating (or check against other merchants suspicions). I did many years later see a service like that but now can’t find it. I did just now find a pretty good list of merchant anti fraud tactics which had tricks nobody told me at the time but I had to figure out myself and were pretty successful: https://support.authorize.net/knowledgebase/Knowledgearticle/?code=000002330 https://support.authorize.net/knowledgebase/Knowledgearticle... Good luck. These guys are persistent. In my case most of them were coming from poor countries where a dollar of fraud is worth a lot more of their time than yours. Until you stop them cold, they will keep coming.

moneywoes 3y ago
What was your most successful defence to these attacks?
- speleding 3y ago
  No OP, but I had it happen to me and adding a "3DS" card verification to the checkout flow made the problem go away. The 3DS step is where they text the customer a number they have to type in to proceed. It's a pain for the customer so I only do it on newish accounts, repeat customers don't get bothered.
- 3y ago

Gijs4g 3y ago

Use Mollie, they have great customer support.

asow92 3y ago

This is something I could see CA, NY, or the EU taking on someday with some sort of "right to digital recourse" law.

T3RMINATED 3y ago

[dead]

moneywoes 3y ago

Are there no alternative payment gateways?

norswap 3y ago

I read about stuff like this every month, but then people (on the internet) tell me there are no uses for blockchains and they're exlusively for scams (yes, scams exists, a lot of them).